时间:2025-04-03 13:34:51 来源:网络整理编辑:綜合
If you perform a very specific query in the search field of online code repository Github, where man
If you perform a very specific query in the search field of online code repository Github, where many Slack bot projects are stored, you can get info that potentially lets you access a trove of corporate data, including companies' internal chats and files.
This is because a lot of Slack bot developers -- and there are a lot of them, since building a Slack bot is quite easy -- included their Slack tokens (personal Slack account credentials) directly in the code, which they share publicly on Github.
SEE ALSO:How do I make Slack apps?The issue was discovered by security company Detectify, which notified Slack about it on March 26. Detectify managed to find "thousands" of such tokens with a simple GitHub search. The story was first reported by Quartz.
Tokens of all types aren't uncommon on GitHub, but the problem is made worse by the way Slack tokens are constructed. In case of private tokens and custom bot tokens, they're a string of characters using these formats:
xoxp-XXXXXXXXX-XXXXXXXXXXXXXXXXXXX
xoxb-XXXXXXXXX-XXXXXXXXX-XXXXXXXXX-XXXXXX
Simply searching for the four letter prefixes on GitHub will net you a lot of tokens in plain text, which we were able to replicate.
If you've never built anything on the Slack platform, you may think this doesn't affect you, and in many cases that's true. But in larger business organizations, it's quite possible that some team member had built a Slack bot and inadvertently revealed their Slack token, potentially exposing company data.
Outsiders can easily gain access to internal chat conversations, shared files, direct messages and even passwords.
"Using the tokens it’s possible to eavesdrop on a company. Outsiders can easily gain access to internal chat conversations, shared files, direct messages and even passwords to other services if these have been shared on Slack," writes Detectify.
The researchers at Detectify have found tokens belonging to Fortune 500 companies, payment providers, Internet service providers health care providers, advertising agencies, university classes and newspapers, among other organizations. And using those tokens, they revealed database credentials, private messages and login details for other services.
The good news is the problem has largely already been fixed. Slack responded to the problem, telling Detectify they've “revoked the tokens you reported, notified affected users and team owners directly, and that we’ll be doing that proactively going forward”.
In other words, if someone makes the same mistake again, Slack will disable the tokens and warn them -- as seen in the message Slack recently started sending to some developers.
Developers, in general, should take care not to place tokens directly in the code and use environment variables instead. Slack admins can make sure only Team Owners and selected Slack members can create tokens and integrations; the option is in Slack's Admin Settings.
Mashablehas contacted Slack about the issue. "Slack is clear and specific that tokens should be treated just like passwords. We warn developers when they generate a token never to share it with other users or applications," a Slack spokesperson said in an email.
According to the spokesperson, Slack will continue to improve its documentation and communications to make sure developers understand this.
"For privacy reasons, we are not sharing information about the teams impacted, however, all of the reported tokens were disabled, as well as others we proactively found. We notified both the users who created the tokens, as well as the owners of affected teams," she wrote.
A popular platform for corporate communication (disclosure: We use Slack at Mashable), Slack boasted more than 2.3 million daily active users in February.
Have something to add to this story? Share it in the comments.
Sound the alarms: Simone Biles finally met Zac Efron2025-04-03 13:32
2023年3月6日【英超】利物浦VS曼聯2025-04-03 13:20
【意甲】全場6張黃牌,維羅納主場02025-04-03 13:00
2023年賽曆 :羽壇忙翻天,球員壓力大2025-04-03 12:47
Mom discovers security cameras hacked, kids' bedroom livestreamed2025-04-03 12:44
梅西連續17年成FIFA最佳陣候選!他基本連續16年進最佳陣!(fifa足球梅西)2025-04-03 12:34
萊萬獲足球先生!梅西C羅連續14次入選最佳陣 ,最佳教練惹爭議(fifa能力值)2025-04-03 12:31
世界足壇曆史最佳“左腳”11人陣容,進攻驚濤拍岸 ,防守不動如山(梅西fifa曆史最高分)2025-04-03 12:17
Uber's $100M settlement over drivers as contractors may not be enough2025-04-03 11:10
2月28日足球賽事推薦 :意甲 足總杯2025-04-03 10:57
You can now play 'Solitaire' and 'Tic2025-04-03 13:28
恭喜梅西!一夜斬獲兩大殊榮 ,加冕曆史第一人 ,C羅傳奇紀錄終結(梅西fifa曆史最高分排名)2025-04-03 13:10
首奪世界羽聯巡回賽冠軍 馮彥哲稱黃東萍為“定海神針”2025-04-03 13:05
2023.02.04 昨夜今晨 英超 比賽集錦 !2025-04-03 12:58
Photos show the Blue Cut fire blazing a path of destruction in California2025-04-03 12:50
周五德甲意甲賽事解析:多特蒙德 VS 萊紅牛 ,那不勒斯 VS 拉齊奧2025-04-03 12:49
國羽開啟新賽季,世界羽聯馬來西亞公開賽開拍2025-04-03 12:37
意甲:AC米蘭各項賽事四連勝,且不失一球,托莫裏狀態複蘇是關鍵2025-04-03 12:30
Pole vaulter claims his penis is not to blame2025-04-03 11:14
3.1周三賽事解析:足總杯英超法國杯八場賽事奉上 !2025-04-03 11:02